Audit finds thousands of courthouse key cards without payroll matches; facilities say deactivation work underway

Jennifer Folliard, Comptroller’s director of audits, reported to the Milwaukee County Committee on Audit on March 3 that a recent audit of courthouse access key cards found nearly 2,000 cards still active that had no association with Milwaukee County payroll records.

Folliard said the audit, released in August of the prior year, identified issues with procedures for terminating key cards and monitoring the program. "We found almost 2,000 key cards that were still active and that had no association with an active employee from the county's payroll system," she told the committee. After additional testing that excluded state employees, judicial offices and parking-only cards, the auditors reported "a little over 1,500 key cards remained without a match." The audit issued 11 recommendations to strengthen policies and monitoring; based on the status report attached to the auditors’ update, all 11 recommendations remain open.

Dustin Schrader, director of security for the Department of Administrative Services’ Facilities Management Division, told the committee the problem stemmed from a synchronization issue between systems used by Facilities and the Sheriff's Department. "We found out is it would not deactivate on the other side," Schrader said, describing cases where a badge was deactivated in one system but still appeared active in the other. Schrader said Facilities and the Sheriff's Department are working together to identify removed employees and remove their badges from both systems and to correct duplicate badge-group entries; he estimated the department has deactivated “about 300 or 400" cards so far and said deactivation work is ongoing.

Aaron Hertzberg, executive director of the Department of Administrative Services, said the department has brought resources to bear to resolve the multiple-access and change-management issues and that a broader set of security upgrades — including replacement of the long-term access control system — will be considered. He said an informational report has been submitted and referred to the SEE committee that will discuss security upgrades next Monday.

Committee members asked whether funding for the replacement and upgrades was in hand. A facilities representative said he believed ARPA funds had been reallocated to the project but did not provide definitive documentation during the meeting.

Committee members also asked if the replacement system will consolidate badges. A department representative said, when the Secure 900 system is in place, there will be a single ID card that will also serve as the access badge.

The auditors said Facilities is in the process of replacing the long-term key card system and that the Comptroller’s Office will request a further status report at the committee’s September cycle. The item was presented as informational only; no formal vote was taken.